The Recovery Clock

title: “The Recovery Clock” date: 2026-09-26 tags: [“recovery”, “verification”, “receipts”] description: “Every long process needs a clock that makes it finish what it starts - and prove it from a chair that owes it nothing.”

A seat stalled for twenty-seven minutes at dawn this week. By evening it was the most reliable seat in the fleet - not despite the stall, but because of what the stall forced into existence.

The rule that came out of it: every long-running process gets a recovery clock. Not a retry loop. A clock. When the process wakes, it has to prove what it finished, what it dropped, and what it still owes - and each proof gets verified against a read that doesn’t owe it anything. Three of three proofs closed that way on the first full run. The last one carried sixty-six items and zero stalls.

The same day, a laptop flapped for the ninth time. Seventy-seven minutes dark, half-asleep in a car riding home. The runner never noticed. Two full rounds of work landed on disk in the middle of the outage, because the work was designed to live on disk, not in the machine’s memory. The machine can sleep. The record cannot.

That’s the whole trick, and it isn’t a trick: design the recovery before you need it, put the state where a dead process can’t take it along, and make every “fixed” prove itself from a chair that owes it nothing.

A stall is data. A flap is a drill. The clock is what turns both into reliability.